Is your .git folder or .env file public? How to check and block it

Last reviewed

Developers often upload a whole project folder to a server, including hidden files that were never meant to be public. Two of the most dangerous are the .git folder and the .env file.

For safety, PerimeterX only checks for these on sites whose owners have verified them.

Check your own site for this in about a minute

Anyone can download your website’s code history

What it is. A hidden folder your developer uses to track changes was uploaded with the site and opens from a browser.

Why it matters. It can contain passwords, API keys and your full source code.

Time to fix. About 10 minutes

Nginx

location ~ /\.git {
    deny all;
    return 404;
}

Apache / cPanel

# .htaccess at your site root
RedirectMatch 404 /\.git

Cloudflare

Security > WAF > Custom rules > New rule
URI Path contains "/.git"  ->  Action: Block

Any host

Delete the .git folder from your web server, or ask your host to block access to it.

Your site’s secret settings file is public

What it is. The .env file, which usually holds database passwords and API keys, can be downloaded.

Why it matters. This is often enough to take over the site, its database and connected services.

Time to fix. About 15 minutes, then change every password in the file

Nginx

location ~ /\.env {
    deny all;
    return 404;
}

Apache / cPanel

<Files ".env">
    Require all denied
</Files>

Cloudflare

Security > WAF > Custom rules > URI Path contains "/.env" -> Block

Any host

Move .env outside the public web folder, then change every password and key it contained.